Internal Audit of the Bangladesh Country Office

March 2019

Office of Internal Audit and Investigations

Report 2019/03

Internal Audit of the Bangladesh Country Office (2019/03) 2 ______

Summary

The Office of Internal Audit and Investigations (OIAI) has conducted an audit of the Bangladesh country office. The audit sought to assess the office’s governance, internal risk management and internal control, with a focus on key risks and activities. The audit team visited the office from 17 September to 9 October 2018, and the audit covered the period from January 2017 to 17 September 2018.

The 2017-2020 country programme has four main components: Young children and their mothers; Boys and girls of primary-school age; Adolescents as agents of change; and Social inclusion and increased awareness on child rights. There is also a cross-sectoral component. The total approved budget for the country programme is US$ 340 million, of which US$ 90 million is regular resources (RR) and US$ 250 million is Other Resources (OR). The budgets for the period under audit (excluding OR emergency funding) were US$ 83.5 million in 2017 and US$ 96.3 million in 2018. Regular Resources are core resources that are not earmarked for a specific purpose and can be used by UNICEF wherever they are needed. Other Resources are contributions that may have been made for a specific purpose such as a particular programme and strategic priority and may not always be used for other purposes without the donor’s agreement. An office is expected to raise the bulk of the resources it needs for the country programme itself (as Other Resources), up to the approved ceiling.

In cases where a country office faces a crisis, it may raise additional resources as OR (emergency) funding. In this case, the office was seeking US$ 149.8 million to meet the immediate life-saving and longer-term development needs of Rohingya refugees and affected host communities. This amount was in addition to the regular OR ceiling quoted above.

The country office is in the capital, Dhaka. There are also zone offices in all six of the other Divisions of Bangladesh (Barisal, Sylhet, Mymensingh, Rangpur, Chittagong and Khulna), and field offices in Rangamati and Cox’s Bazar. As of September 2018, the country office had 231 approved posts, of which 52 were for international professionals, 121 for national officers and 52 for general service staff. There were also six volunteers.

During the second half of 2017, renewed violence in Rakhine State, Myanmar, drove an estimated 687,000 Rohingya, including 371,000 children, across the border into Cox’s Bazar, Bangladesh. As of 28 September 2018, UNICEF estimated that there were 1.3 million refugees and members of the host community in need. This included 703,000 children in need of humanitarian assistance. UNICEF had extended the Level 31 emergency to 31 December 2018. The influx of Rohingya refugees had an important impact on UNICEF programming; the office had to find a delicate balance between development programme and the large-scale emergency response, which had begun in August 2017. The crisis demanded an increased level of engagement and resources.

1 UNICEF defines an emergency as a situation that threatens the lives and well-being of a population and requires extraordinary action to ensure their survival, care and protection. There are three levels of emergency response: Level 1 – the scale of the emergency is such that a country office can respond using its own staff, funding, supplies and other resources, and the usual Regional Office/HQ support; Level 2 – the scale of emergency is such that a country office needs additional support from other parts of the organization to respond, and the Regional Office must provide leadership and support; and Level 3 – the scale of the emergency is such that an organization-wide mobilization is called for.

Internal Audit of the Bangladesh Country Office (2019/03) 3 ______

The audit noted several areas that were functioning well. The office set clear priorities and the country management team regularly monitored progress. It also assigned accountabilities for results to designated staff. There was a participatory management culture and consultative leadership to involve staff in decision making through the office’s committees and teams. The office’s oversight and coordination committees functioned well; for example, the country management team (CMT)2 met regularly, reviewed relevant programme and operational issues and recorded appropriate action points.

Almost all staff had completed the online mandatory ethics and anti-fraud training; 258 out 263 staff had completed the Ethics online training course, and 81 out of 86 active consultants. The office had engaged a staff counsellor and adopted flexible work options, surge/mission deployments, and rest and recuperation to help staff affected by the significant demands of the response to the Rohingya refugee crisis. The joint consultative committee met regularly to promptly address staff issues. The staff association also held several activities in Dhaka and field offices as appropriate.

Action agreed following the audit The audit identified a number of areas where further action was needed to better manage risks to UNICEF’s activities. In discussion with the audit team, the country office has agreed to take a number of measures to address these risks and issues. One is rated as high priority (that is, requiring immediate management attention). This was as follows:

• Ensure that rolling workplans (RWPs) are completed and signed on time; revise the guidelines for preparation of the 2019-2020 RWPs; and carry out a quality review of the workplan for Cox’s Bazar.

Conclusion Based on the audit work performed, OIAI concluded that, subject to implementation of the agreed actions described, the controls and processes over the country office were generally established and functioning during the period under audit.

The Bangladesh country office, the Regional Office of South Asia and OIAI intend to work together to monitor implementation of the measures that have been agreed.

Office of Internal Audit and Investigations (OIAI) March 2019

2 An office’s CMT advises the Representative on the management of the country programme and on strategic programme and operations matters. It consists of senior staff from Programme and Operations sections, and staff representatives.

Internal Audit of the Bangladesh Country Office (2019/03) 4 ______

Contents

Summary 2

Objectives 5

Observations 5

Risk management 5 Programme strategy design and results framework 6 Convergence 8 Work planning 8 Emergency response to the Rohingya refugee crisis 10 Monitoring programme activities and results 11 Assurance activities 13 Audit visits to refugee camps 15 Evaluation 16 Staffing structure 17 Staff recruitment 18 Resource mobilization and donor relationships 18 Child safeguarding and PSEA 20 Partnerships and grant management 20 Cash transfers to partners 21 Cash grant programme 22 Contracts for services 23 Construction 23 Financial and administrative management 24 Warehouse management 25

Annex A: Methodology, and definition of priorities and conclusions 27

Internal Audit of the Bangladesh Country Office (2019/03) 5 ______

Objectives

The objective of the country-office audit was to provide assurance as to whether there were adequate and effective controls, risk-management and governance processes in the most important risk areas.

This report presents the most important risks and issues found by the audit, the measures agreed with the client to address them, and the timeline and accountabilities for their implementation. It does not include lower-level risks, which have been communicated to the client in the process of the audit.

Audit observations

Risk management UNICEF country offices should manage risks to their programme in a structured and systematic manner. The organization’s Enterprise Risk Management policy is currently being revised, but it requires offices to perform an annual risk assessment to identify, assess and manage risks that threaten the achievement of results. The assessment should include a mitigation plan for each significant risk.

The audit noted the following.

Risk assessment and mitigating actions: In November 2017, staff from programmes and operations completed an office-wide risk assessment. At mid- 2018, the field offices had conducted their own risk assessments, focusing on five key risks to programme implementation in their respective areas. This had informed the 2018 mid-year office-wide risk assessment. The root causes and impacts were assessed for each risk, and a mitigation plan with assigned responsibilities, timelines and indicators of completion was prepared. The number of high risks increased from five in 2016 to eight in November 2017 and June 2018.

However, though the CMT had reviewed and endorsed the risk assessment and mitigation plan, it did not set the office’s risk appetite. This is important because UNICEF’s risk- management policy is not that no risks should be taken; it is that they should be assessed against the potential benefits for children.

The office could also have been more thorough in linking the planned mitigating measures with the root causes they were expected to address. For instance, for the risk of funding and stakeholder external relations, the root cause was given as “Funding-driven donor agenda, not in line with UNICEF strategic direction”; however, this was not specifically addressed by the planned mitigating measures and action plan. The audit also noted that there were no targets established for the mitigating measures, which would make it hard to ensure their timely implementation to mitigate the risks identified.

The office had updated the mitigation plan in August 2018. However, although several mitigating measures had been implemented, the office had not changed the risk ratings accordingly. The status update also did not show any escalation of risks that might be justified in case of lack of capacity or authority to manage them, or indication as to whether a risk required a coordinated or organization-wide response, particularly with respect to the Level 3 emergency.

Internal Audit of the Bangladesh Country Office (2019/03) 6 ______

There were also several risks that were not explicitly in the risk assessment, although the office had cited them elsewhere – for example in the country programme documents, programme strategy notes, annual management plan and the annual and mid-year programme reviews. Examples of these risks included: limited cross-sectoral collaboration; changes in government’s stances for humanitarian access, repatriation and refugee status; and insufficient support from central Government.

Fraud risk: Since the issue of UNICEF’s Anti-Fraud Strategy in August 2018, the office had increased its efforts to mitigate the risks associated with fraud, including anti-fraud awareness training for staff and partners. It had recently conducted a fraud-risk assessment. It had also drawn up a comprehensive action plan, but, as of the time of the audit, it had not started implementing it. The office had rated the risk of fraud and corruption as high, but its mitigation plan was not sufficient to address its vulnerabilities in this respect, and there was insufficient evidence that it had actively encouraged partners to adopt robust anti-fraud policies. The audit team noted that some recent cases of suspected fraud and irregularities involving implementing partners (which had been submitted to OIAI) could lead to loss of funds and could stop or delay programme activities.

Agreed action 1 (medium priority): The office agrees to, with support and guidance from the Regional Office of South Asia, reinforce oversight over risk management, including fraud risk; and to take the following specific steps:

i. Ensure that all key risks identified in the country programme document, strategy notes, and management and programme priorities are explicitly incorporated in the office-wide risk assessment and action plan. ii. Ensure clear linkages between the root causes of identified risks and the planned mitigation actions. iii. Ask the country management team (CMT) to advise the Representative on the office’s risk tolerance in key risk areas and ensure that risk responses or mitigating actions are aligned with risk tolerance levels. iv. To assess progress in managing risks, establish targets against the indicators used to measure the implementation of mitigating actions. v. Complete implementation of the anti-fraud action plan, and regularly report progress of implementation to the CMT.

Responsible staff members: Deputy Representative and Chief of Operations Date by which action will be taken: i) December 2019; ii) the office reports this action as having been completed; iii) March 2019; and iv) and v), April 2019

Programme strategy design and results framework As part of programme planning, country offices prepare programme strategy notes setting out how they will achieve programme results in the most efficient and effective manner. Strategy notes should outline the plan of action to achieve the proposed outcomes3 of the country programme, including a results framework and the resources required. The office’s strategy notes identified 14 priority issues (including five for the outcome Young children and their mothers and four for Adolescents as Agents of Change).

3 An outcome is a planned result of the country programme, against which resources will be allocated. It consists of a change in the situation of children and women. An output is a description of a change in a defined period that will significantly contribute to the achievement of an outcome. Thus, an output might include (say) the construction of a school or clinic, but that would not in itself constitute an outcome; however, an improvement in education or health arising from it would.

Internal Audit of the Bangladesh Country Office (2019/03) 7 ______

The rationale for selecting the 14 priority issues, the root causes and the assumptions were generally well explained and justified. However, the audit noted the following.

Results framework: There were some inconsistencies between the results framework in the country programme document (CPD)4 and the strategy notes. The office had revised the results framework after the CPD was submitted for approval to the Executive Board, to increase its capacity to measure programme results with the introduction of the new life-cycle approach5 in programming. For instance, the number of outcome indicators was 13 in the CPD and 30 in the strategy notes. Further, the number of outputs was 14 in the CPD and 21 in the strategy notes.

The four outcomes and 21 outputs included in the office’s workplans had indicators, targets and means of verification. However, three out of 115 output and outcome indicators had no baseline. Further, the baselines of some indicators established in the results framework were taken from outdated sources, and a significant proportion of baselines in the results framework did not indicate the dates of the data at all. Weaknesses in baselines can constrain the establishment of realistic targets.

Risk analysis: The strategy notes prepared by each programme section of the office assessed external risks and identified mitigating actions. However, the risks and mitigating actions were said to be the same for the four outcomes; it does not seem likely that this was the case. Further, important risks were excluded from the risk analysis, such as weak capacity of implementing partners; risk of fraud and corruption; insufficient support from central-level government; insufficient data and information at the divisional and district level; and low capacity of Government programme managers and frequent shifts of key programme focal persons (see also observation on Risk management, above).

Agreed action 2 (medium priority): The office agrees to, with the support of the Regional Office of South Asia:

i. Revise the results framework, ensure all indicators have baselines that are taken from recent sources, and indicate their dates in the results structure. ii. Update strategy notes to expand risk analysis to include recurrent risks such as weak capacity of implementing partners, risk of fraud and corruption, and data gaps at the divisional and district levels.

Responsible staff members: Deputy Representative, Programme Monitoring and Reporting, and outcome leads Date by which action will be taken: i) The office reports this action as having been completed; and ii), May 2019

4 The CPD sets out the office’s programme for the country programme cycle. It is submitted to UNICEF’s Executive Board and, once approved, becomes the official blueprint for the country programme, which normally runs for five years. 5 The life-cycle approach implies considering the multiple dimensions that affect a child during a given phase of their life.

Internal Audit of the Bangladesh Country Office (2019/03) 8 ______

Convergence The diverse needs of children can often be addressed at the same time and place, or through programme components designed to complement each other. UNICEF encourages this approach, referring to it as convergence. The new 2017-2020 country programme introduced a new life-cycle approach with the objective of promoting convergence.

The office had made some progress in this area. It said that it had implemented convergence in some programmes, such as Ending child marriage and Programming in urban areas. The former, for example, can have syntheses with other initiatives aimed at adolescents, and finding these would be in line with the life-cycle approach, given that this approach requires looking at all the factors which affect a child at a given stage in their life. In 2018 the office had hired a consultant to develop a framework and an approach to convergence.

However, the CPD said little about programme convergence, and the strategy notes did not include an analysis of convergence or action plans to ensure convergence between key activities of relevant programme components. During a visit to Cox’s Bazar field office, audit noted that convergence had not been clearly integrated in the district workplan. In fact, the 2018 mid-year review identified the need to immediately focus on convergence during programme implementation with support from the highest authorities. At the time of the audit, however, the office had not assessed lessons learned with respect to planning, implementation, monitoring and reporting on convergence.

Agreed action 3 (medium priority): The office agrees to define a clear office-wide strategy and action plan to secure effective convergence of programmes at the district and sub-district levels. To this end, the office will revise the programme strategy notes of each programme, or develop a stand-alone convergence strategy note for all programme components. It should also identify lessons learned on convergence, and revise processes and allocate staff responsibilities accordingly.

Responsible staff members: Deputy Representative; Programme Monitoring and Reporting; Outcome leads and Section Chiefs Date by which action will be taken: August 2019

Work planning UNICEF offices are required to agree workplans with their partners. These workplans can be developed on an annual or multi-year basis, or as rolling workplans (RWPs). In the latter case, the workplan is subject to interim review by UNICEF and the partners, after which it can be extended. Workplans are expected to detail outputs, indicators, targets, baselines, activities to be carried out, the responsible implementing institutions, timelines and planned inputs from the partners and UNICEF. Workplans serve as basis for programme disbursements to partners and are expected to be signed with key partners before the end of February of the year of implementation. The audit looked at the office’s work planning and noted the following.

Timeliness: The office issued 19 national-level RWPs for 2018-2019. Eight of them were signed late – that is, after February 2018, between 11 March to 2 September. Another RWP had yet to be signed as of the time of the audit. Meanwhile, zone offices prepared divisional implementation plans (DIPs) by extracting relevant activities from their respective draft RWPs. The DIPs were finalized after the signing of RWPs and were not signed by national or sub- national government counterparts. Delayed finalization and approval of RWPs and DIPs led to some delays in programme implementation.

Internal Audit of the Bangladesh Country Office (2019/03) 9 ______

Quality: The office had issued guidelines for the development of 2018-2019 RWPs and divisional implementation plans (DIPs) in October 2017. The audit reviewed a sample of 2017- 2018 and 2018-2019 RWPs. Each programme section in the country office had consulted national partners. The RWPs and DIPs were results-based and included linkages with the UNDAF6 outcomes. However, the RWPs signed with the Government partners omitted the emergency response to the Rohingya refugee crisis. The office explained that the Rohingya, forcibly displaced nationals of Myanmar, had not been declared refugees by the Government of Bangladesh; the latter therefore did not allow long-term planning for the Rohingya response.

Cox’s Bazar Field Office: The district workplan for the Cox’s Bazar Field Office included the interventions planned for Cox’s Bazar in the Chittagong Field Office DIP, together with the Joint Response Plan and the Humanitarian Action for Children (HAC),7 revised in May 2018. The district workplan was developed in consultation with the Government partners of Cox’s Bazar, and other UN agencies in the district.

However, it did not include the estimated cost and planned input for each activity, or the calendar of implementation or timelines for either the emergency response or the regular programme. Further, the planned outcomes, outputs and activities for the emergency response and the regular programme, as described in the district workplan, were not integrated but presented separately – as requested by the Government of Bangladesh. The office did understand the need to establish the right balance between emergency response and development programme, and to connect emergency and development interventions.

At the time of the audit, the country office in Dhaka had yet to do a quality assurance review of the district workplan.

Agreed action 4 (high priority): The office agrees to:

i. Ensure the rolling workplans (RWPs) are completed, and signed by implementing partners, on time, so as to minimize programme implementation delays. To this end, the office will request signatures only from the single highest authority of each Government partner. ii. Revise the guidelines for the development of the upcoming 2019-2020 RWPs, including the integration where possible of work planning for humanitarian and development assistance for Rohingya refugees and the host communities. iii. Ensure the country office in Dhaka carries out a quality assurance review of the district workplan of Cox’s Bazar.

Responsible staff members: i) and ii), Deputy Representative, and Programme Monitoring and Reporting and Outcome leads; and iii), Deputy Representative; Programme Monitoring and Reporting Dhaka and Cox’s Bazar; and section Chiefs Date by which action will be taken: i) and ii), The office reports this action as having been completed; and iii), May 2019

6 The United Nations Development Assistance Framework (UNDAF) is a broad agreement between the UN as a whole and a national Government, setting out the latter’s chosen development path, and how the UN will assist. 7 HAC stands for Humanitarian Action for Children. A HAC is an appeal that UNICEF launches for assistance for a particular crisis or emergency response, and will state how much UNICEF thinks it needs to raise for a given situation. The appeals page is at https://www.unicef.org/appeals/; the page for Bangladesh can be found at https://www.unicef.org/appeals/bangladesh.html.

Internal Audit of the Bangladesh Country Office (2019/03) 10 ______

Emergency response to the Rohingya refugee crisis At the onset of the crisis, UNICEF reacted quickly to the significant sudden influx of refugees, providing life-saving assistance and protection, and minimizing the risk of potential major epidemics. It formally activated a Level 3 emergency response on 20 September 2017. UNICEF led the coordination of the nutrition sector and child protection sub-sector. It co-led the education sector, and the WASH (water, sanitation and hygiene) sector in support of the Department for Public Health Engineering (DPHE). The office provided humanitarian assistance in child protection, education, nutrition, health and WASH. It published a Humanitarian Action for Children and a revised response plan in October 2017 to address the immediate and urgent needs of the affected Rohingya children, women, and adolescents.

UNICEF’s Evaluation Office recently reviewed the response (Evaluation of UNICEF’s Response to the Rohingya Refugee Crisis in Bangladesh8). Besides assessing the adequacy of UNICEF response in providing humanitarian assistance, it looked specifically at how well UNICEF works with implementing partners. As the Evaluation Office had recently carried out this work and is – like OIAI – a part of UNICEF’s independent internal oversight, OIAI has chosen not to duplicate its work or its recommendations, which are in the final evaluation report.

The audit noted that the evaluation did not review the efficiency of humanitarian interventions in the sense of analysing inputs in relation to outputs (there was a lack of detailed reliable information on the cost of inputs). However, the evaluation did use alternative ways to look at the efficiency of the response.

The Evaluation Office concluded that UNICEF had risen to the challenge, despite the speed and scale of the refugee influx, extreme congestion in the camps and the enormous needs of the refugees. The audit met several implementing partners in Cox’s Bazar. All commended UNICEF for its partnership and support in responding immediately to the crisis. The evaluation noted significant achievements in scaling up, advocacy, sector leadership and service delivery.

However, the evaluation also identified several areas for improvement. While it found that UNICEF reached many of the programme targets in each of the five sectors, on others it had fallen behind; these included hygiene promotion, education and response to gender-based violence. The evaluation also noted that, due to the extreme speed and scale of the influx, and the almost non-existent infrastructure, UNICEF had prioritized quantity over quality in the first weeks and months of the response. It accepted that this had been the best approach under the circumstances but noted that the quality of the response was also affected by other factors, including gaps or delays in recruiting key staff positions, inter-agency tensions and lack of implementing partner capacity. The audit also found weak capacity of partners (see also the observation Partnership management).

The evaluation also stated that there could have been a more explicit strategy with respect to unique context, priorities, links across sectors and overall vision and plan. One Government partner met by the audit also said that, at the onset, there was not enough space and time to plan and think. This partner confirmed that coordination was a big challenge at the beginning and was still an issue as of the time of the audit, given the high number of UN agencies and development partners. The Evaluation Office also noted the need to improve coordination by clarifying the roles and responsibilities of sector leads in relation to their home agency, UNICEF and the inter-agency coordination structures. In the view of the evaluation team, the

8 Available at https://www.unicef.org/evaldatabase/index_103442.html.

Internal Audit of the Bangladesh Country Office (2019/03) 11 ______coordination difficulties might have been mitigated by using one of the two well-established models for humanitarian inter-agency coordination. The team noted that UNICEF was a strong advocate for improved coordination. However, it could possibly have pressed this further.

Congestion remained a serious problem. The audit visited three refugee camps and noted significant space limitations (see also observation Audit visits to refugee camps, below). This was not sufficiently addressed in the office-wide risk assessment in November 2017 (updated August 2018) or in the Cox’s Bazar Field Office risk assessment completed in July 2018 (see observation Risk management, above). The Evaluation Office also found that the UNICEF strategic response should have taken more account of the extreme congestion in the camps.

In its final evaluation report, the Evaluation Office has included priority recommendations to improve the effectiveness of the emergency response. The implementation of the recommendations will be monitored by the Evaluation Office in accordance with the UNICEF evaluation policy.

Monitoring programme activities and results UNICEF offices monitor programme implementation through a number of mechanisms. Some are for monitoring the progress on activity implementation. Others are part of the Harmonized Approach to Cash Transfers (HACT), which provides assurance on the use of programme funds by partners. The audit sought to assess the overall effectiveness of the Bangladesh Country Office’s processes for monitoring and assurance, both within the HACT framework and outside it. This observation concerns those not part of HACT (assurance activities under that structure are discussed in the following observation). However, there is considerable crossover between the two, as HACT involves some programmatic monitoring as well as reviews of partners’ financial procedures.

The audit reviewed the office’s use of various monitoring mechanisms and noted the following.

Annual and mid-year programme reviews: The country office, and the other UNICEF offices in the country, carried out mid-year and annual programme reviews of the regular programme with Government and other partners in 2017-2018. The audit reviewed a sample of these reviews and found that key achievements, challenges or risks, and opportunities were generally well assessed, and recommendations were appropriate to address the identified challenges.

The audit noted the Cox’s Bazar field office did not carry out a mid-year review of district workplan implementation of the HAC. This was because the HAC had been issued in January 2018 and revised in May, and the workplan had been completed late in June 2018. However, the office had planned to carry out an annual review by December 2018. Further, a mid-term review of the joint response plan for the Rohingya humanitarian crisis (covering the period March-December 2018) had been completed in August-September 2018. This review aimed to assess progress against strategic objectives and to identify key achievements, challenges and priorities by sector. The final report was issued on 7 October 2018.

Humanitarian response monitoring: The humanitarian performance monitoring (HPM) team in Cox’s Bazar was responsible for collection, analysis and consolidation of humanitarian data and results. The monitoring framework for the Rohingya response was aligned with UNICEF

Internal Audit of the Bangladesh Country Office (2019/03) 12 ______global programme monitoring standards. An online partner’s reporting portal, launched in March 2018, enabled partners to report on high-frequency performance indicators on a regular basis. The information was then used by the Cox’s Bazar field office to prepare situation reports. The office said that the credibility of data collected from partners was verified through field-monitoring and programmatic visits (see below), and through weekly updates from the 10 camp/site coordinators.

Field monitoring: Staff in the field and Dhaka’s offices carried out several field-monitoring visits each month. Digital data collection and analysis tools were used for field monitoring. Further, staff in the WASH programme section contracted a third-party monitor to oversee technical areas such as the quality of latrine construction. The Bangladesh Country Office had issued guidance on field monitoring in July 2015 and a field monitoring checklist in July 2018. The field-office manual, issued in September 2017, also provided general guidance on field monitoring. However, the recently-established Cox’s Bazar field office was unaware of the field-office manual. The audit also noted that the current guidance on monitoring did not explain the links between field monitoring of implementation, and programmatic visits in the context of HACT.

The audit reviewed a sample of field-monitoring reports and found that most reports included recommendations, but without timelines, priority ratings and assigned responsibilities. There was no central database that stored all field-monitoring reports prepared by UNICEF staff, standby partners and third-party monitors. There was also no office-wide mechanism for tracking implementation of key recommendations from all field-monitoring visits from January 2017 to the end of July 2018.

In August 2018, the office introduced e-Tools9 and started to use the trip module to monitor the recommendations. The office organized e-Tools training session for all staff, including those in Cox’s Bazar field office. However, the office had not yet brought e-Tools fully into use as of the time of the audit.

Programmatic visits: A programmatic visit is a key component of programme monitoring. It provides assurance that results reported by the implementing partners are accurate. It also provides evidence on progress towards achievement of planned results, challenges and constraints in implementation, and ways to address them. A programmatic visit is a type of field monitoring, but is quite specific in its agenda, whereas field-monitoring visits in general may cover less or more of an activity.

The office completed 331 out of 320 planned programmatic visits in 2017; and, as of 31 July 2018, 290 (89 percent) out of 327 planned programmatic visits. The audit reviewed a sample of 10 reports from programmatic visits carried out in Dhaka and field offices (including Cox’s Bazar) from January 2017 to September 2018. It found that the recommendations were generally specific and closable. In nine of the 10 cases, the high-priority recommendations from previous PVs were properly followed up. Where applicable, the status and quality of supplies were properly reviewed. Lessons learned, opportunities and challenges were generally well identified and assessed.

However, only six out of the 10 reports sampled included an analysis of progress observed by UNICEF staff against the partner-reported status. For these six cases, there was no description of the methodology used by UNICEF staff to validate the accuracy of observed progress against the partner’s report. Further, although all 10 reports described the partner’s actual

9 A suite of digital tools being rolled out across UNICEF that will help offices with a number of tasks.

Internal Audit of the Bangladesh Country Office (2019/03) 13 ______achievements against the established indicators and targets, only one described the means of verification used for this by UNICEF staff.

Agreed action 5 (medium priority): The office agrees to, with support from the Regional Office:

i. Update the office-wide guidelines on programme monitoring to clarify its purpose, responsibilities for it, and the tools and tracking mechanisms that should be used. ii. Increase oversight and quality assurance over programmatic visits to ensure partners’ reported achievements are supported with adequate means of verification and supporting documentation kept in the partner’s office. This can be done through sampled programmatic spot checks of reported achievements.

Responsible staff members: i), Deputy Representative and Programme, Monitoring and Reporting; and ii), Deputy Representative and Section Chiefs Date by which action will be taken: i), June 2019; and ii), July 2019

Assurance activities The Harmonized Approach to Cash Transfers (HACT) is a set of procedures used by several UN agencies to ensure that cash transfers to partners are used as intended. Its principle is to do a risk assessment (a ‘micro-assessment’) of the specific partner and manage the relationship with the partner accordingly. This is meant to cut down on bureaucracy, but without reducing vigilance in cases where fraud seems more likely. The results of a micro-assessment should determine the level and frequency of assurance activities used with that partner. These include programmatic visits to review progress on funded activities – these are discussed in the previous observation. They also include spot checks, scheduled audits and, where necessary, special audits.

HACT also involves a ‘macro-assessment’, which is an assessment of the public financial management systems in a country that enables a decision as to whether Government institutions can be used for audit purposes. This had last been done in Bangladesh in 2017, by the UN agencies that use HACT in the country (UNICEF, UNDP and UNFPA). The office’s decision to use Bangladesh’s Foreign Aided Project Audit Directorate (FAPAD) for auditing Government partners was informed by the macro-assessment of the public financial management systems completed in 2017 by UN agencies.

The CMT reviewed HACT implementation regularly. The office had introduced a HACT accountability matrix and had work processes for the management of assurance activities. It carried out all of, and sometimes more than, its planned assurance activities. For example, it had planned 320 programmatic visits in 2017 and in fact conducted 331; of 327 planned for 2018, 290 had taken place as of September. In 2017 there were 95 spot checks, one more than planned; in 2018 there had so far been 67, 11 more than planned. There had also been one more scheduled audit than planned in 2017 (23 instead of 22).

This reflected the fact that the office’s assurance plan complied with the minimum requirements in UNICEF’s HACT guidelines, while the number of assurance activities included

Internal Audit of the Bangladesh Country Office (2019/03) 14 ______in the programme documents10 agreed with partners reflected the specific risks attached to that partner. They were therefore greater in number than those in the assurance plan. This is in accordance with the principle of HACT, which is that the number and type of assurance activities should be risk-based. The HACT guidelines specify a minimum level of assurance activities that is based on an organization-wide understanding of risk. The programme documents, however, are based on context-specific risks. In the view of the audit, the assurance plan should be aligned with them. This will also make it clear what assurance activities need to be done, and the resources can be allocated accordingly.

The audit noted one case where the funds released to a local implementing partner increased from US$ 34,550 in 2017 to US$ 307,978 in 2018. The office’s partnership review committee (PRC) noted some high risks and recommended an increase in the number of assurance activities, but the office still carried out the minimum assurance activities for this partner. This could increase the risk of misuse of funds and fraud.

The office had a central repository of assurance activity reports to track the implementation of recommendations from various assurance activities. However, there were lengthy delays in the implementation of recommendations from HACT-related audits. The database included 119 high-priority recommendations, including 43 open longstanding recommendations issued in 2012/2013 to Government partners. These longstanding recommendations came from scheduled audits of government partners that had received direct cash transfers (DCTs) from UNICEF.

FAPAD had conducted these audits and was responsible for follow-up of the recommendations. FAPAD’s procedures were to track these only once a year. The audit also noted that the recommendations it sampled were not specific and measurable – which could make them hard to close. The office said it had realized this and was discussing it with FAPAD.

Agreed action 6 (medium priority): The country office agrees to, with assistance from UNICEF’s Field Results Group and the Regional Office for South Asia, strengthen its processes, including training of staff, so that:

i. Assurance activities required in signed programme documents are reflected in the overall HACT assurance plan. ii. Long-standing audit recommendations addressed to Government partners by the Government auditors are closed promptly, to improve controls over the use of funds; and advocate to the Comptroller and Auditor General’s office that it increase the frequency of follow-up. The office also agrees to report long-outstanding audit recommendations to the designated accountable Government body or office.

Responsible staff members: i) HACT Manager; and ii) Chief of Operations Date by which action will be taken: i) March 2019; and ii) The office reports this action as having been completed

10 A programme document is a foundation-block of a proposed collaboration between a country office and an implementing partner, and includes planned activities, target results, performance indicators, budgets and timelines. It precedes the formal partnership agreement, which will be based on it.

Internal Audit of the Bangladesh Country Office (2019/03) 15 ______

Audit visits to refugee camps For the Rohingya refugee response, UNICEF led the nutrition sector and child protection sub- sector, and co-led the education and WASH sectors, for the emergency response in Cox’s Bazar. UNICEF reported that, as of 23 September 2018, it provided non-formal education to 106,493 children (aged 4-14), against the 2018 annual target of 151,765 children. This was done through 2,807 trained teachers in 891 operational learning centres (LCs) in the refugee camps. The audit visited three of the 34 refugee camps in Cox’s Bazar, where it looked at the functioning of four LCs. It did this together with UNICEF staff (including the site coordinators) and three implementing partners. The LCs visited by the audit provided Rohingya refugee children aged 4-14 years with access to an early learning and basic education programme.

The audit noted significant space constraints in the camps, with limited or no space for the construction of LCs or nearby latrines. The four LCs themselves were in good condition, but ventilation was insufficient. The audit was told that UNICEF had planned to install fans in LCs but this had not started as of the time of the visit. Enrolled children received school bags and other learning materials; the LCs in two out of the three camps visited maintained a register of what had been provided to every child, with dates and the child’s signature. The two LCs visited in the third camp did not do this.

The school bags, exercise books and other materials were of good quality, and were in use by children in the classrooms. The teachers of the visited LCs confirmed that they had received basic teacher training and instruction on the use of learning materials from UNICEF’s Government and NGO partners. The teachers of the LCs visited said that there was a functioning management committee, composed of parents and teachers, that met monthly. According to the teachers, the most important concerns raised by the parents were the lack of text books and the absence of learning certificates to show learning progress. UNICEF was in the process of revising the learning curriculum with the Government.

The UNICEF office reported that, as of 23 September 2018, its Government partner had, with UNICEF and donor assistance, completed the construction of 1,500 latrines and 5,000 bathing cubicles, and decommissioned 2,000 abandoned latrines. The office also reported that this partnership benefited 30,000 people through improved latrines and provided 100,000 adolescent girls and women with access to improved bathing cubicles.

The audit observed a sample of army latrines in two camps; they were functioning and mostly of good quality, but some needed maintenance and repairs. The maintenance of the latrines remained a challenge, given that some of the partners who built latrines at the inception of the crisis had already left or would do so soon. A key Government partner said that a strategy was needed to ensure continued operations and maintenance of the latrines, of which there were an estimated 50,000 in all the refugee camps. Poor maintenance increased the risk of failures, contamination of the environment, and disease.

Agreed action 7 (medium priority): The office agrees to:

i. Together with the Government, complete the revision of the learning curriculum to ensure children have access to an improved quality of learning, including advanced learning certificates; and procure the necessary text books to meet the objectives of the revised learning curriculum. ii. Strengthen implementation and monitoring of the WASH sector strategy to ensure continued operation and maintenance of UNICEF-constructed latrines in the camps.

Internal Audit of the Bangladesh Country Office (2019/03) 16 ______

Responsible staff members: i), Education Manager (Cox’s Bazar) and Chief of Education (Dhaka); and ii), WASH Specialist and WASH Manager (Cox’s Bazar) Date by which action will be taken: i) March 2019; and ii) June 2019 and on-going

Evaluation Programme evaluations seek to determine the relevancy, efficiency, effectiveness, impact and sustainability of UNICEF programme interventions. Each programme component should be evaluated before replication or scaling-up; when responding to major humanitarian emergencies; and when expenditure on a given component has reached US$ 10 million. The Bangladesh Country Office had an evaluation management team, established in March 2017; it met twice in 2017, and once every quarter in 2018. It prioritized evaluations that contributed to organizational learning, accountability and decision-making.

The audit reviewed the office’s evaluation function and noted the following.

Planning: The four-year costed evaluation plan was incorporated in the CPD, and therefore into the Board-approved programme. It identified five planned evaluations for the duration of the programme cycle, for a total budget of US$ 600,000. These planned evaluations were included in the office’s four-year integrated monitoring and evaluation plan (IMEP). The office also planned to evaluate two further activities, one providing stipends for adolescents, and the other conditional cash transfers.

However, some significant programme components had not been included in the plan for evaluation. That was the case for the WASH and child protection programmes, though they significantly exceeded the US$ 10 million threshold, with planned expenditures of US$ 49.2 million and US$ 28.9 million respectively during the 2017-2020 programme cycle.

Implementation: In 2017-2018, the office completed two evaluations carried forward from the previous 2014-2017 country programme. The audit noted delays in the start dates of some planned evaluations for the 2017-2020 programme cycle. For instance, the Education evaluation was planned to start in 2017 but had been delayed due to other priorities, although the inception phase was expected to be completed by December 2018. The evaluations of conditional cash transfers and stipends for adolescents had not started as of the end of July 2018. Further, the evaluation of Ending Child Marriage (ECM) had been postponed from the start date of October 2017 due to a lack of funding. As UNICEF’s Evaluation Office in HQ now planned a global evaluation of ECM, the office had asked instead that it include Bangladesh as a case study.

Further, the Evaluation Office, which is charged with evaluating UNICEF’s response to all Level 3 emergencies, recently carried out an Evaluation of UNICEF’s Response to the Rohingya Refugee Crisis in Bangladesh (see observation Emergency response to the Rohingya refugee crisis, above).

The office’s status reports assessed progress against the planned completion dates of each planned evaluation since the second quarter of 2018. Status reports were submitted to the evaluation management team for review, but not to the CMT for oversight.

Monitoring: The evaluation management team did not monitor the implementation of evaluation recommendations. Some planned actions (using words such as “strengthen”) were not specific and contributed to slow implementation. As of September 2018, 25 and 17

Internal Audit of the Bangladesh Country Office (2019/03) 17 ______percent of the planned corrective actions established in 2017 and 2018 respectively showed no action taken. Further, only 44 percent of planned corrective actions of the 2017 evaluation had been completed.

Agreed action 8 (medium priority): The office agrees to:

i. Include the WASH and child protection programmes in the evaluation plan, as they each exceeded US$ 10 million in planned expenditures during the programme cycle; and secure funding for evaluation of these two significant programmes. ii. Submit regular status reports on programme evaluation to the Country Management Team (CMT) for oversight purposes. iii. Ensure planned key corrective actions arising from completed programme evaluations are specific and closable and establish an action plan to ensure those corrective actions are implemented promptly.

Responsible staff members: i) and ii), section Chiefs and SPEAR; and iii), Section Chiefs and Programme, Monitoring and Reporting Date by which action will be taken: i), June 2019; ii), December 2019; and iii), April 2019

Staffing structure The CPMP11 for the current country programme had been prepared in 2016. It defined the rationale of the changes in the staffing structure, including the responsibilities of the country office, the zone offices (located in Barisal, Sylhet, Mymensingh, Rangpur, Chittagong and Khulna), the one sub-office (located in Rangamati and reporting to the Chittagong office), and the two outposts (one located in Cox’s Bazar and reporting to Chittagong field office; and the other located in Rajshahi and reporting to Rangpur field office). All heads of zone offices reported to the Chief of Field Offices (who reported to the Deputy Representative). There was one exception – the head of the Cox’s Bazar office, who reported directly to the Representative.

The outpost duty station in Cox’s Bazar, established at the start of the country programme, was responsible for management of the Rohingya humanitarian crisis in close coordination with the Chief of Field Offices based in Dhaka and the UNICEF staff based in Chittagong. At the start of the emergency in 2017 and the first quarter of 2018, UNICEF staff in the Chittagong and Dhaka offices significantly supported the delivery of UNICEF humanitarian assistance in Cox’s Bazar.

The field office in Cox’s Bazar had now recruited staff for some functions that had hitherto been carried out by the country office in Dhaka, such as transaction processing. In June 2018 the office made a PBR12 submission for a long-term structure that would combine emergency interventions with longer-term activities to reinforce local service systems and ensure the sustainability of UNICEF programme interventions. However, at the time of the audit, the office had not analysed in depth the opportunities, challenges and constraints of the staffing

11 When preparing a new country programme, country offices prepare a country programme management plan (CPMP) to describe, and help budget for, the human and financial resources that they expect will be needed. 12 The programme budget review (PBR) is a review of a UNICEF unit or country office’s proposed management plan for its forthcoming country programme. For a country office, it is carried out by a regional-level committee. An office can also request a specific adjustment through an ad hoc PBR, as in this case.

Internal Audit of the Bangladesh Country Office (2019/03) 18 ______structure. This was important because the emergency meant that the office had taken on numerous staff, and now needed to decide which should be kept in the long term, and on what basis, as it transitioned to longer-term programme implementation.

Agreed action 9 (medium priority): The country office agrees to clarify the responsibilities, authorities and accountabilities of the Cox’s Bazar field office in the light of the constantly evolving operating environment, the significance of emergency funds, the major increase in the number of posts and the necessary gradual transition from humanitarian to development assistance.

Responsible staff members: Deputy Representative, Chief of Field Office and Chief of Operations Date by which action will be taken: June 2019

Staff recruitment The office is responsible for background and reference checks. The audit reviewed a sample of 10 recruitments completed in 2017 and 2018 and found that reference checks had been done for only three, who were external candidates. Where checks had been done, negative feedback did not disqualify the candidate.

The office stated that informal reference feedback was obtained for internal candidates, but it was not documented. The office also said it reviewed staff performance evaluation forms of internal candidates. However, it had not implemented the 2017 additional guidance from DHR to obtain and document formal feedback and take action if negative feedback was received. (The audit has no evidence that this feedback in any way related to prevention of sexual exploitation and abuse had been, or would have been, ignored.)

Agreed action 10 (medium priority): The office agrees to carrying out background reference checks and ensure the results are duly considered in the selection of both internal and external candidates.

Responsible staff members: Chief of Human Resources Date by which action will be taken: The office reports this action as having been completed

Resource mobilization and donor relationships The total budget for the 2017-2020 approved country programme was US$ 340 million, of which US$ 90 million was Regular Resources (RR), and US$ 250 million (73.5 percent) was Other Resources (OR). The office was also seeking an additional US$ 149.8 million to meet the immediate life-saving and longer-term development needs of Rohingya refugees and affected host communities, estimated at 1.3 million people in total. The audit noted the following.

Resource mobilization:13 Since the current country programme had begun in 2017, the office had raised US$ 71.6 million, or 30 percent of the approved OR ceiling of US$ 250 million. As

13 While the terms “resource mobilization” and “fundraising” are often used interchangeably, the former is slightly broader; although fundraising is its largest single component, it also includes mobilizing resources in the form of people (volunteers, consultants and seconded personnel), partnerships, or equipment and other in-kind donations.

Internal Audit of the Bangladesh Country Office (2019/03) 19 ______of 4 October 2018, several programme components were significantly underfunded. For instance, the WASH programme was underfunded by US$ 7.7 million (69 percent of the planned amount), the Nutrition programme by US$ 3.4 million (59 percent of the planned amount), the HIV/AIDS programme by US$ 659,000 (89 percent of the planned amount), and the Field Services area by US$ 1.7 million (80 percent of the planned amount). There were several reasons for these funding gaps in the regular programme, including the continuing growth of humanitarian assistance related to the Rohingya crisis, which required significant attention by the office; uncertainties in donor countries; and the increasing difficulty of raising funds for the social sectors in Bangladesh, which is perceived as becoming a middle-income country.

Regarding the funding of the refugee crisis, UNICEF had obtained US$ 70.7 million in 2017- 2018, which was 93 per cent of the US$ 76.1 million of the 2017 HAC appeal. However, as the funding received from the initial appeal was insufficient, the office had obtained an additional US$ 11 million from UNICEF’s own internal Emergency Programme Fund (EPF). As of September 2018, the office had received US$ 107.4 million, representing 72 percent of the amount requested in the HAC appeal, which had been for US$ 149.8 million. In 2018, the office had developed a distinct fundraising strategy to address the needs of the Rohingya response (the overall fundraising strategy for the new 2017-2020 country programme had been completed in 2016, before the Rohingya refugee crisis).

The 2017-2020 fundraising strategy included actions to address significant underfunded programmes (such as the WASH programme) but did not clearly set out specific actions to support investment in social services. The office had recently recruited of a resource mobilization manager and planned to review its fundraising strategy.

Donor relationships: The office had a mechanism to monitor the quality and timeliness of donor reports. Most had been submitted on time, but there were a small number of exceptions. In one case, this was because the funds themselves had been delayed; they had originally been routed via another UN body, which had remitted them to UNICEF late. The office commented that funds had been delayed for this reason in several cases and was concerned that this could cause misunderstandings with the original donor.

The audit met two donors; they expressed satisfaction with UNICEF’s partnership. They were satisfied with the office’s timely explanation of delayed implementation, where this occurred. However, one donor said that it was not kept informed of any cases of fraud. In this case, the fund manager had been another UN agency, which had transferred some funds to UNICEF to be used for specific purposes. It was therefore that agency’s responsibility to communicate with the donor, not UNICEF. However, unclear communication could have a negative impact on a donor relationship.

Agreed action 11 (medium priority): The office agrees to:

i. Update its resource mobilization strategy by including specific actions to address significant underfunded areas in the regular country programme. ii. Ensure that there is proper communication with donors in cases of fraud, including those in which UNICEF is not the fund manager.

Responsible staff members: i), Deputy Representative; and ii), Resource Mobilization Specialist Date by which action will be taken: i) and ii), 30 April 2019, and on-going

Internal Audit of the Bangladesh Country Office (2019/03) 20 ______

Child safeguarding and prevention of sexual exploitation and abuse UNICEF has a zero-tolerance policy for sexual exploitation and abuse (SEA) perpetrated by employees, personnel and private contractors. The audit reviewed the prevention of SEA (PSEA) processes in the Dhaka office and field office located in Cox’s Bazar. It focused on Cox’s Bazar because of the high-risk operating environment related to the emergency crisis; it is generally acknowledged that the risk of SEA is usually elevated in humanitarian crises, during which women and children are particularly vulnerable.

Like other UN bodies, UNICEF had adopted the UN Protocol on Allegations of Sexual Exploitation Involving Implementing Partners. Approved in February 2018, this new protocol requires offices to establish an integrated approach and to focus more on cross-sectoral and integrated programming in the field of violence prevention, detection and response.

The office had made some progress in implementing PSEA processes in Cox’s Bazar. The country office had trained UNICEF staff, implementing partners and third-party monitors on the new PSEA requirements established by UNICEF’s Field Results Group. A PSEA specialist from NYHQ also provided technical assistance in establishment of a PSEA network and processes in Cox’s Bazar. A number of other key steps had been taken, and the office had a process for review of SEA allegations against implementing partners, and communication of the results internally.

However, the office had no clear process and standards for communicating the results of SEA reviews to implementing partners and donors. The audit met a donor who confirmed it did not receive any information on SEA cases. Further, while UNICEF’s Supply Division carried out background checks for internationally-recruited contractors, the Bangladesh office did not do this for locally-recruited contractors.

Agreed action 12 (medium priority): The office agrees to strengthen its controls over child safeguarding and prevention of sexual exploitation and abuse by establishing a process and standards for communicating SEA issues to implementing partners and donors. It will consult relevant NYHQ divisions, including the UNICEF legal advisor, on what the process and standards should be.

Responsible staff members: Deputy Representative; Programme, Monitoring and Reporting; Child Protection and Human Resources Date by which action will be taken: August 2019

Partnerships and grant management Bangladesh has many NGOs providing social services, microcredit and other services. The office told the audit that there were more than 23,000 NGOs, of which approximately 4,000 worked in the health, population and nutrition sectors. As of October 2018, the office worked with 70 such organizations, and with 151 Government partners. It had paid US$ 34 million in direct cash transfers in 2017, and US$ 40 million in 2018 as of October.

The audit reviewed a sample of 10 project cooperation agreements (PCAs) with NGOs and noted a significant increase of partnerships and direct cash transfers to the same implementing partners. In five PCAs, the office issued more than one programme documents (PDs) to the same partner, leading to inefficiencies in programme implementation and monitoring. Further, several PDs related to the emergency response in Cox’s Bazar were often

Internal Audit of the Bangladesh Country Office (2019/03) 21 ______amended. One PD was issued only two months before the expiry of the grant used to fund the activities and was then extended twice at no cost to complete the planned activities.

The audit met two local implementing partners in Cox’s Bazar and found they had limited capacity due to high staff turnover. They said that international NGOs and UN agencies offered better salaries and benefits. One donor also raised concerns regarding the impacts of low salaries of volunteer staff in some local NGOs partnered with UNICEF. Further, the office did not have a strategy for increasing the capacity of implementing partners, particularly in the context of transitioning from humanitarian assistance to resilience building in Cox’s Bazar.

The audit also reviewed the management of seven grants. It found several delays throughout the process, from fund remittance to UNICEF by the fund manager to receipt of funds by the UNICEF office. In one case, the delay was one month. Late receipt of funds could delay programme implementation.

Agreed action 13 (medium priority): The country office agrees to:

i. Assess, during the mid-term review, the key risks, opportunities and lessons learned regarding the management of partnerships; and then define a partnership strategy to increase the capacity of implementing partners in the context of gradual transition from emergency to development assistance in Cox’s Bazar. ii. Together with the Division of Financial and Administrative Management (DFAM) and the Public Partnerships Division (PPD), review the process for managing grants received from a UN agency acting as fund manager, to ensure funds are processed and released promptly.

Responsible staff members: i), Deputy Representative; Programme, Monitoring and Reporting; and Field Services; and ii), Deputy Representative; Chief of Operations; Programme, Monitoring and Reporting; and Finance Date by which action will be taken: i), July 2019; and ii), June 2019

Cash transfers to partners The office had disbursed US$ 34 million in 2017, and US$ 40 million in 2018 as of October, in direct cash transfers (DCTs) to implementing partners. This represented a considerable proportion of the office’s total budget. The audit reviewed a sample of 11 DCTs amounting to US$ 8.5 million in 2017 and US$ 13.9 million in 2018 (as of October) paid to eight implementing partners.

DCTs are disbursed for activities to be implemented over a three-month period. In seven of the 11 DCTs reviewed, the partners were late in submitting the FACE forms14 with the funding requests; they were received up to five months after the implementation had started. In those instances, payments were processed close to the activity end date, and in one instance the payment was released after it. Seven out of the 11 DCTs sampled by the audit were urgent payments and were processed only two days before the start date of the activity. The remaining four requests took up to six weeks to process; this is not unusual in normal circumstances, but in an emergency the funds should be processed more quickly, and the

14 The Funding Authorization Certificate of Expenditure (FACE) form is used by the partner to request and liquidate cash transfers. It is also used by UNICEF to process the requests for and liquidation of cash transfers. The FACE forms should reflect the workplans, which set out the activities for which funds are being requested, or on which they have been spent.

Internal Audit of the Bangladesh Country Office (2019/03) 22 ______delays had slowed programme implementation. This was due to inadequate planning. (The audit acknowledges the pressures on the office in an emergency, which can make proper planning of activities extremely difficult.)

After an activity, the partner and UNICEF must liquidate the DCT that was disbursed to fund it; the partner therefore has to certify the expenditure. An office should review the certificates of expenditures submitted by implementing partners within three months. The audit sampled seven such certifications and found that for two of these, the office had had taken eight months. The delays may have occurred because recently recruited staff in Cox’s Bazar had not been trained and did not have access to the UNICEF information management system, VISION. The audit also sampled seven refunds by partners (these occur when a partner has been unable to spend the funds as planned). It found there could also be delays in recording refunds in UNICEF’s books due to the Bangladesh banking system – 20 days in one case.

Seven sampled FACE forms were not certified, dated and duly signed. Programme codes were also not mentioned for some transactions. In other cases, the activity duration and programme cooperation agreement (PCA) reference number were not mentioned. These omissions reduced the assurance on the certification of expenditures and prevented proper recording in the UNICEF accounting system.

Agreed action 14 (medium priority): The office agrees to strengthen its processes, including training of staff, to ensure direct cash transfers to implementing partners are disbursed, processed and accounted for in a timely manner. It will also ensure that they are justified with adequate supporting documentation, including correctly completed FACE forms.

Responsible staff members: Chief of Operations Date by which action will be taken: June 2019

Cash grant programme The cash grant programme was designed for foster families, to avoid placement of children in orphanages and children’s centres in refugee camps (UNICEF practice is to ensure children live in a family environment wherever possible). This innovative approach had been introduced by the child protection programme section. In accordance with the principles outlined in UNICEF`s Cash-Based Approaches in Humanitarian Action,15 the cash assistance targets families and not individual members in the household. The cash assistance was to be implemented for six months initially, targeting 9,000 foster families and child-headed households.

The cash grant programme was rolled out by the Department of Social Service of the Government since June 2018, four months before the audit. As of the time of the audit in October 2018, 18 percent of the targeted beneficiaries had been reached. UNICEF had signed a project cooperation agreement with an NGO for an amount of US$ 1.1 million.

The office’s standard operating procedures require it to verify and certify that accurate payments are made, and only to identified families or beneficiaries. However, the office did not verify the accuracy and completeness of data used to support cash grant to beneficiaries. It therefore did not obtain reasonable assurance that the right amount of cash was paid to the right beneficiaries, exposing the programme to the risk of fraud (the audit was not aware of any having been committed).

15 See http://www.unicefinemergencies.com/downloads/eresource/cash_in_emergencies.html.

Internal Audit of the Bangladesh Country Office (2019/03) 23 ______

Agreed action 15 (medium priority): The office agrees to work closely with the Regional Office for South Asia and NYHQ to assess key risks, challenges and lessons learned from this new innovative approach, and adjust its standard operating procedures accordingly. It will also conduct regular quality assurance reviews to ensure accurate cash amounts are transferred to the right beneficiaries.

Responsible staff members: Chief of Child Protection Date by which action will be taken: October 2019

Contracts for services The audit reviewed 22 contracts for services, amounting to US$ 1.6 million, issued from January 2017 to October 2018. It found that several UNICEF contracting rules, regulations and policy requirements had not been adequately enforced.

The office should pay standard daily subsistence allowance (DSA)16 rates for the first 60 days and a reduced DSA rate after the first 60 days for individual contractors. In one case, the office paid the standard DSA for the entire stay (110 days), thus overpaying the contractor for 50 days. The office later said it had requested and received a credit note from the contractor to correct this.

In two of the sampled contracts, the office did not apply the negotiated rate. In one case this led to an overpayment of US$ 19 per day (again, the office had taken steps to recover the overpayments by the end of the audit fieldwork).

The office did not comply with UNICEF contracting requirements in two out of three contracts issued to the same contractor. It used an institutional contract to recruit a retired staff member, instead of issuing an individual contract. However, the terms of reference and the proposed fee were for an individual consultant rather than an institutional contractor. Further, the proposed fee was linked to the staff level prior to retirement rather than the deliverables for that contract. This practice increases the risk of overpaying for professional services.

There was also contradictory supporting documentation. For instance, a contractor who was a former staff member signed a retiree declaration form, which specifies that the consultant will not receive more than US$ 22,000 per year in total from UNICEF and other UN agencies. However, the consultant had two contracts from UNICEF and was paid over US$ 22,000. The office said that the consultant was not a retiree, but the audit noted that the consultant had ceased to be a staff member in UNICEF in 2014. The audit also found five out of 22 sampled contracts had been signed after the start date.

Agreed action 16 (medium priority): The office agrees to strengthen its oversight over the application of controls related to the management of contracts for services. It will also establish a quality assurance improvement process to regularly test those controls, and where appropriate will take prompt action to recover any overpayments to contractors.

Responsible staff members: Chief of Operations Date by which action will be taken: June 2019

16 According to UNICEF procedure on duty travel (DHR/Procedure/2017/11 rev.1. issued in December 2017), a daily subsistence allowance (DSA), sometimes referred to as travel subsistence allowance, is payable for periods of service during which the staff member is on official travel. Depending on the duration of the duty travel, different rates of DSA will apply.

Internal Audit of the Bangladesh Country Office (2019/03) 24 ______

Construction The audit reviewed three contracts amounting to US$ 1.1 million related to the renovation, extension and new construction of cold rooms and cold chains in 22 districts. The contracted work was expected to be implemented in two phases. Phase one (lots 1 and 2) covered 12 districts and phase two (lots 3 and 4) covering nine districts.

Phase 1 was awarded to two construction companies and the work was completed in 11 out of 12 districts. Lots 2 and 3 were awarded to one of these two companies. The office recruited a contractor to monitor the construction process. The contractor submitted monitoring reports for each district and a final report. The office staff also conducted field monitoring trips.

The audit reviewed a sample of field-trip reports and noted the review of progress made by the office. A review of the contractor’s reports noted several weaknesses. The office said that recommendations made by the supervising contractor had been addressed in various meetings. However, the contractor did not update the status of these in their subsequent reports (although the final report stated that all recommended actions had been addressed and the construction work done as planned).

Most project supervision reports noted construction safety needed to be improved. For example, the absence of safety helmets and safety shoes was a recurrent recommendation. The audit did not find any actions taken to address this issue.

There had been no progress in one district (Joyphurhat) and ongoing work in another district was cancelled. However, the contract value had not been adjusted to reflect this. Further, the donor report did not state that the work had not been completed, or explain why.

Agreed action 17 (medium priority): The office agrees to increase its oversight and quality assurance review processes, and:

i. Ensure that contractors comply with UNICEF general conditions of contracts, such as site safety and security. ii. Establish a specific tracking mechanism to monitor issues raised in construction reports.

Responsible staff members: Construction Specialist Date by which action will be taken: May 2019

Financial and administrative management The office should have adequate processes in place to ensure transactions are properly justified and recorded in accordance with relevant UNICEF policies and procedures. The audit reviewed a sample of transactions and noted the following.

Payments received by authorized party on behalf of partner: UNICEF policy allows cash transfers to an authorized party on behalf of an implementing partner, under a specific arrangement (such as a memorandum signed among partners).

In October 2017, UNICEF supported the construction of 10,000 latrines in response to the emergency in Coxs' Bazar. The audit noted that the UNICEF partner established in the

Internal Audit of the Bangladesh Country Office (2019/03) 25 ______workplan and in the Funding Authorization Certificate of Expenditure (FACE)17 form for this activity was different from the partner, to whom payments totalling US$ 4.7 million had been made. The two entities had established a Memorandum of Understanding (MoU) to clarify this special arrangement. However, the requirements stated in the MoU were not reflected in VISION; neither were the related payments to the third party.

Travel: UNICEF procedures on travel requires staff to travel with a valid travel authorization (TA) processed in VISION and approved by the appropriate authorizing officer. If travel occurs without a TA, it must be recorded in VISION. From January 2017 to September 2018, the office processed approximately 5,613 local TAs that amounted to US$ 1.6 million. However, the office had been piloting a new system under e-Tools without proper approval. This allowed all in-country programme travel (including air travel) to be undertaken without a TA in VISION. In effect, the office was not overseeing the issue of travel authorizations.

The audit noted that UNICEF travel policies and procedures had not been revised and amended to reflect the new risks posed by the e-Tool. The office had not reviewed the working of the system for local travel over the past two years, or the risks related to the use of the e- Tool.

Agreed action 18 (medium priority): The office agrees to, with support from DFAM and the Regional Office of South Asia:

i. Ensure the requirements of any special arrangement between a partner and a third party are accurately recorded in VISION. ii. Seek approval for piloting the e-Tool, and in the meantime maintain the manual system for local travel system. Review the key risks related to the use of e-Tools and define mitigating measures, and update local travel workflows and standard operating procedures as required.

Responsible staff members: Chief of Operations; Date by which action will be taken: i), May 2019; and ii), March 2019

Warehouse management Following the Rohingya crisis, the office had increased its warehousing capacity. To enable effective and timely emergency response, the office also prepositioned emergency programme supplies. The total value of programme supplies stored in warehouses amounted to US$ 4.9 million as of 7 October 2018. This included prepositioned emergency supplies valued at US$ 2.1 million. The supplies stored in the warehouses for more than six months amounted to US$ 717,000.

The audit visited three warehouses located in Cox’s Bazar, one managed by the field office and two by NGOs. It found that supplies were well organized in the warehouses. One of the office’s storage locations (17 rooms rented in a motel near the office) was used to store sensitive programme supplies (such as medicines and emergency kits) in rooms that were temperature-controlled and not prone to flood. The office had noted it was not a cost- effective solution and was considering other storage options at the time of the audit.

17 The Funding Authorization Certificate of Expenditure (FACE) form is used by the partner to request and liquidate cash transfers The FACE forms should reflect the workplans, which set out the activities for which funds are being requested, or on which they have been spent.

Internal Audit of the Bangladesh Country Office (2019/03) 26 ______

The field office in Cox’s Bazar had done a capacity assessment of 34 warehouses used by partners. The assessment found several opportunities and challenges. For example, it noted that the medicines provided to three implementing partners were not always kept in temperature-control rooms. Inadequate storage could affect the efficacy of the medicines. Meanwhile the country office in Dhaka had reviewed the results of all field-monitoring visits completed in 2018 and had also found that several implementing partners had limited warehouse and inventory management capacity. As of the end of the audit fieldwork, the office had not drawn up a plan of action to mitigate these key risks. However, it was planning to train partners on warehouse and inventory management.

Agreed action 19 (medium priority): The office agrees to:

i. Review the cost-effectiveness of Cox’s Bazar warehouses and take appropriate action. ii. Draw up a cost-effective strategy to mitigate key risks related to delivering programme supplies to partners with limited warehouse and inventory management capacity. iii. Train partners in warehouse and inventory management.

Responsible staff members: i), Chief of Field Office (Cox’s Bazar); ii), Operations Manager of Field Office (Cox’s Bazar); iii), Operations Manager and Supply and Logistics Specialist of Field Office (Cox’s Bazar) Date by which action will be taken: i) and ii), the office reports this action as having been completed; and iii), August 2019

Internal Audit of the Bangladesh Country Office (2019/03) 27 ______

Annex A: Methodology, and definitions of priorities and conclusions

The audit team used a combination of methods, including interviews, document reviews, testing samples of transactions. It also visited UNICEF locations and supported programme activities. The audit compared actual controls, governance and risk management practices found in the office against UNICEF policies, procedures and contractual arrangements.

OIAI is firmly committed to working with auditees and helping them to strengthen their internal controls, governance and risk management practices in the way that is most practical for them. With support from the relevant regional office, the country office reviews and comments upon a draft report before the departure of the audit team. The Representative and their staff then work with the audit team on agreed action plans to address the observations. These plans are presented in the report together with the observations they address. OIAI follows up on these actions and reports quarterly to management on the extent to which they have been implemented. When appropriate, OIAI may agree an action with, or address a recommendation to, an office other than the auditee’s (for example, a regional office or HQ division).

The audit looks for areas where internal controls can be strengthened to reduce exposure to fraud or irregularities. It is not looking for fraud itself. This is consistent with normal auditing practices. However, UNICEF’s auditors will consider any suspected fraud or mismanagement reported before or during an audit and will ensure that the relevant bodies are informed. This may include asking the Investigations section to take action if appropriate.

The audit was conducted in accordance with the International Standards for the Professional Practice of Internal Auditing of the Institute of Internal Auditors. OIAI also followed the reporting standards of International Organization of Supreme Audit Institutions.

Priorities attached to agreed actions

High: Action is considered imperative to ensure that the audited entity is not exposed to high risks. Failure to take action could result in major consequences and issues.

Medium: Action is considered necessary to avoid exposure to significant risks. Failure to take action could result in significant consequences.

Low: Action is considered desirable and should result in enhanced control or better value for money. Low-priority actions, if any, are agreed with the country- office management but are not included in the final report.

Conclusions

The conclusions presented in the report summary fall into four categories:

[Unqualified (satisfactory) conclusion] Based on the audit work performed, OIAI concluded at the end of the audit that the office’s

Internal Audit of the Bangladesh Country Office (2019/03) 28 ______governance, risk management and internal controls were generally established and functioning during the period under audit.

[Qualified conclusion, moderate] Based on the audit work performed, OIAI concluded at the end of the audit that, subject to implementation of the agreed actions, the office’s governance, risk management and internal controls were generally established and functioning during the period under audit.

[Qualified conclusion, strong] Based on the audit work performed, OIAI concluded that the office’ governance, risk management and internal controls needed improvement to be adequately established and functioning.

[Adverse conclusion] Based on the audit work performed, OIAI concluded that the office’s governance, risk management and internal controls needed significant improvement to be adequately established and functioning.